By wire vehicle control systems provide a number of advantages with regard to system packaging. The associated electronic control systems and the implementation of advanced computer control algorithms facilitate a number of new control features. However, such systems also typically remove any direct mechanical or hydraulic force transmitting path between the vehicle operator and the controller. Therefore, much attention has been given to designing by wire vehicle control systems and control architectures that ensure their operability in response to an event (e.g., any event which negatively impacts or affects control signals, data, hardware, software or other elements associated with the operation of such systems) occurring in the control path between the control command initiated by the operator and the associated controller. One general technique which has been employed in such systems is redundancy, to provide fault tolerance to such events. One design approach to provide fault tolerance which has been utilized in by wire vehicle control systems has been to design control systems and control architectures which ensure that no single point event in the portion of the system associated with the operator control commands will cause an inability to determine the intended control command.
FIG. 1 schematically illustrates a vehicle 200 having a related art vehicle control system 210. A configuration such as illustrated for vehicle control system 210 would be applicable to a vehicle having a plurality of by-wire control systems, such as by-wire steering control, accelerator control and braking control systems. Vehicle control system 210 comprises three vehicle or system controllers to provide the desired redundancy associated with the control of vehicle, a first controller 212, a second controller 214 and a third controller 216. These controllers are each operatively connected to a controller bus 218 and are each in signal communication with one another, such that any information or input received by one of the controllers may be shared with any or all of the other controllers. Controllers 212,214,216 are adapted to receive a plurality of unprocessed or raw sensor signals associated with a corresponding plurality of respective sensors and signal lines, including steering actuator sensor signals 220,222,224, accelerator actuator sensor signals 226,228,230 and brake actuator sensor signals 232,234,236. Each of the controllers receive the redundant sensor signals and utilize known voting techniques to assure that a representative steering, accelerator and braking control signal or command will be available even in the event of a single point event related to a sensor, signal line or a controller. However, this control architecture does not provide significant redundancy or fault tolerance with respect to a single point event related to controller bus 218 because such an event may make it impossible for controllers 212,214,216 to vote to determine the representative steering, accelerator and braking sensor signal to be used for control of these systems.
FIG. 2 schematically illustrates a vehicle 300 having a second related art vehicle control system 310. A configuration such as illustrated for vehicle control system 310 would also be applicable to a vehicle having a plurality of by-wire control systems, such as by-wire steering control, accelerator control and braking control systems. Vehicle control system 310 comprises three vehicle or system controllers to provide the desired redundancy associated with the control of vehicle, a first controller 312, a second controller 314 and a third controller 316. These controllers are each operatively connected to a controller bus 318 and are each in signal communication with one another, such that any information or input received by one of the controllers may be shared with any or all of the other controllers. Controllers 312,314,316 are each adapted to receive a processed steering sensor signal 319, which is determined using a steering actuator sensor module 321 from a plurality of unprocessed steering actuator sensor signals 320,322,324 from a corresponding number of redundant steering actuator sensors, a processed accelerator sensor signal 325, which is determined using an accelerator actuator sensor module 327 from a plurality of unprocessed accelerator actuator sensor signals 326,328,330 from a corresponding number of redundant accelerator actuator sensors, and a processed brake actuator sensor signal 331 which is determined using a brake actuator sensor module 333 from a plurality of unprocessed brake actuator sensors signals 332,334,336 from a corresponding number of redundant brake actuator sensors. The processed sensor signal of each of the controls is determined from the respective raw sensor signals in an associated signal processing module. The controllers receive the redundant processed sensor signals and may utilize known voting techniques to assure that a representative steering, accelerator and braking control signal or command will be available should a single point event occur related to a sensor, signal line or controller. However, this control architecture does not provide significant redundancy or fault tolerance with respect to a single point event related to one of the signal processing modules, because such an event may affect the processed sensor signal associated with the module in which the event occurs, thus making it impossible for controllers 312,314,316 to provide vehicle control associated with such signal. Also, if voting is utilized, this architecture does not provide significant redundancy or fault tolerance with respect to a single point event related to the controller bus, as described above.
Therefore, it is desirable to provide a control system and system architecture that provides enhanced redundancy and fault tolerance with respect to various single point events of the types described above.